CERT Basic Fuzzing Framework (BFF)

The CERT Basic Fuzzing Framework (BFF) is a software testing tool that
finds defects in applications that run on the Linux and Mac OS X
platforms. BFF performs mutational fuzzing on software that consumes
file input. (Mutational fuzzing is the act of taking well-formed
input data and corrupting it in various ways, looking for cases that
cause crashes.)

The BFF automatically collects test cases that cause
software to crash in unique ways, as well as debugging information
associated with the crashes. The goal of BFF is to minimize the effort
required for software vendors and security researchers to efficiently
discover and analyze security vulnerabilities found via fuzzing.

Traditionally fuzzing has been very effective at finding security
vulnerabilities, but because of its inherently stochastic nature
results can be highly dependent on the initial configuration of the
fuzzing system. BFF applies machine learning and evolutionary
computing techniques to minimize the amount of manual configuration
required to initiate and complete an effective fuzzing campaign. BFF
adjusts its configuration parameters based on what it finds (or does
not find) over the course of a fuzzing campaign. By doing so it can
dramatically increase both the efficacy and efficiency of the
campaign. As a result, expert knowledge is not required to configure
an effective fuzz campaign, and novices and experts alike can start
finding and analyzing vulnerabilities very quickly.

Some of the specific features BFF offers are:

Minimal initial configuration is required to start a
fuzzing campaign

Minimal supervision of the fuzzing campaign is required,
as BFF can automatically recover from many common problems
that can interrupt fuzzing campaigns

Uniqueness determination through intelligent backtrace
analysis

Automated test case minimization reduces the effort
required to analyze results by distilling the test case to the
minimal changes to the input data required to induce a
specific crash

Online machine learning applied to fuzzing parameter and
input file selection to improve the efficacy of the
campaign

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription or become our Facebook fan! You will get all the latest updates at both the places.